She Wakes Up Every Morning Assuming She's Already Breached - Hackers On The Rocks Podcast

Summary of Main Arguments and Key Points

• Podcast format & setup: The episode of Hackers on the Rocks blends light conversation (including diet soda/drink trivia and personal anecdotes) with a structured cybersecurity discussion. Guest Riana Scholtz explains how she entered the field and what threat hunting involves in practice.

Riana’s Background in Cybersecurity

• She describes growing up in a small, rural environment with limited early exposure to computer science.
• A Python class sparked her interest, which helped her shift toward computer science, eventually leading her to discover a cybersecurity major.
• She frames cybersecurity as:
  • creative problem-solving
  • the ability to break others’ solutions, which initially drew her in

Definition of Threat Hunting

• Threat hunting is described as actively searching for threats that aren’t necessarily caught by existing detections.
• It’s compared to investigative work (e.g., Criminal Minds/NCIS), where defenders look for:
  • patterns
  • signatures
  • behavioral “tells” left behind by attackers

“Pyramid of Pain” and a Maturity Progression

Riana explains a progression using the Pyramid of Pain concept:

• Bottom layer: Indicators of Compromise (IOCs) (e.g., IPs, hashes, domains)
  • Valuable, but attackers can change them easily.
• Higher layers: more behavioral/intent-based detection
  • Harder for attackers to change
  • Harder to hunt without deeper understanding

Key idea: Threat hunting becomes more valuable as organizations mature and move toward behavioral understanding and more advanced detection programs.

“Assume You’re Breached” Mindset

• She emphasizes operating with the mindset that your organization may already be compromised:
  • Would you detect it?
  • Or would you only find it afterward?
• Existing controls (e.g., EDR/AV, firewalls, MFA, email security) generate alerts and detections, but:
  • out-of-the-box alerts can create alert fatigue
  • they aren’t always accurate

Threat Hunting vs. SOC / Blue Team Roles (and Detection Engineering)

• Roles are presented as overlapping and evolving across:
  • SOC triage
  • incident response
  • detection engineering
  • threat hunting
• She argues security work is moving away from purely ad-hoc efforts toward more specialized detection engineering:
  • a “second stage” of defense maturity
  • formalizes how to improve detections based on what was missed

When to Start Threat Hunting

• There’s “never a right time” to feel fully ready, but readiness may include:
  • alerts that are frequently 85%+ true/benign-positive in context
  • defenders beginning to ask why earlier tools/vendors didn’t catch an issue

Framing: Threat hunting is less a luxury and more a next step after baseline detection capability is established.

Balancing Staffing Constraints and Cost

• Threat hunting requires:

  • time
  • log storage
  • analysis → so it can be expensive.

• Organizations often discover coverage gaps, which create backlog “technical debt.”

• A practical approach is to start with high-impact, low-cost actions before building a full internal team.

Practical, Cost-Effective Starting Ideas

• Use open-source and community intelligence, along with automated hygiene checks.
• Example workflow:
  • Use Have I Been Pwned-style checks to see if executive/employee emails were breached
  • Then improve password hygiene and monitor for credential reuse attempts
• Emphasize that hunting should tie to defensive actions (e.g., blocking or improving detections), with careful verification to avoid false positives such as misidentifying employees as attackers.

Where Hunting Teams Get Data (Data Sources)

• Start with vendors and meet with them regularly (monthly/bi-monthly) to:
  • understand what they’re seeing
  • ask about threat feeds
  • validate detection effectiveness
• Use MSPs/security providers similarly to understand cross-industry trends.
• Engage with the security research community and public advisories (including those from the FBI).
• Follow sources like Bleeping Computer and The Hacker News (including via RSS).

How AI Fits into Her Workflow (and Explained Tools)

Riana describes using AI bots to ingest threat-related RSS feeds and produce outputs such as:

• YARA rules
• Snort rules/signatures
• Splunk queries

High-level tool explanations:

• YARA: pattern matching to identify malware/artifacts
• Snort: network intrusion detection using signature-style matching
• Splunk: central log analysis/queries via a “pane of glass”/SIM

Advice for Managers Starting a Threat Hunting Program

• Understand what you already have:
  • baseline detection/tools
  • available data
• Use frameworks and training, especially MITRE learning resources.
• Start small and build maturity:
  • automate compromised credential checks
  • ingest threat feeds
  • create initial detection improvements
• She also highlights political/budget realities:
  • security doesn’t directly generate revenue
  • ROI framing matters
  • organizations may underinvest

Critique of Over-Outsourcing Security Decisions

• She describes organizations delegating security to providers without trusting their judgment, leading to poor enforcement (e.g., not blocking malicious/phishing-related categories).
• Her view: security should include checks and balances, data-backed decisions, and reasonable blocking policies (e.g., phishing/hack-tool/C2 categories).

Career Path: Becoming a Threat Hunter

She frames entry as building fundamentals:

• understand how detections work
• learn why artifacts are bad/good (not just submitting hashes to VirusTotal)
• tell the “story” of an incident chain:
  • how it happened
  • impact
  • spread
  • victims

She suggests:

• gaining SOC analyst experience as a practical on-ramp into hunting/detection engineering
• using hands-on labs and training platforms, including:
  • MITRE
  • Madr20 (mentioned as offering tiers and hands-on exercises)

Emerging Threat Trends and AI Impact (Future Outlook)

• Attackers will likely use AI agents to automate and scale capabilities, potentially including:
  • malware crafting “on the fly”
• AI could reduce the effectiveness of defender reliance on static signatures, since generated malware/code may behave similarly but appear different in artifacts/logs.
• Defensive upside: AI-generated code may be sloppy or easier to reverse.
• Overall effect: proactive defense pressure increases.

Presenters/Contributors

• Riana Scholtz (guest)
• Evan (host/interviewer; name appears as “Evan” in the subtitles)